As of 5 May 2016, the Islamic State of Iraq and the Levant (ISIL) Sympathizer hacking group United Cyber Caliphate (UCC) defaced a Nigerian-hosted Web site, posting an html file containing the heading “USA Online Company Data Dumped by United Cyber Caliphate,” there was no other message or threat associated with the file. The file contained approximately 1,137 entries, many of which appeared to be US-based individuals with corresponding personally identifiable information (PII) fields such as name, company, e-mail, phone, city, state, and zip code. The PII was doxed from the personnel directory of a US business, according to FBI and open source reporting.

According to FBI reporting, the most recently released information was obtained using a new technique for UCC, a simple letter query2 on the personnel registry database of a US-based business. UCC exfiltrated the PII by exploiting the open source nature of the personnel directory search function by entering each letter from A to Z, yielding all users within the directory which started with each respective letter. The resulting file was posted to the defaced Web site. FBI reporting indicates this is the first time UCC has used a simple letter query to exfiltrate data, but this does not reflect an expansion of UCC’s cyber capabilities.

UCC is responsible for a number of computer intrusions, data exfiltrations, Web site defacements/injects, and PII doxing of victims around the globe. UCC utilizes social media sites and applications to publish the results of its criminal acts, typically by posting PII of its victims. UCC actively promotes allegiance to ISIL, and its publications call for ISIL-inspired attacks against the victims whose PII has been released. ISIL and its sympathizers have repeatedly called for attacks by US-based ISIL supporters against military, law enforcement (LE), security and intelligence personnel via data exfiltrations and incitement of lone-wolf attacks through doxing of PII. Between 21 April 2016 and 2 May 2016, UCC began expanding its doxing efforts to include private citizens with the release of PII belonging to approximately 2,100 New York-based individuals and 1,500 Texas-based individuals, according to FBI and open source reporting. This expansion further validates the group’s anti-American sentiments, as well as an increased threat to targets of opportunity.

Threat

The FBI is unaware of any specific, credible threats by ISIL or its sympathizers against LE or private sector partners, and previous doxing releases have not successfully instigated physical attacks. However, ISIL supporters and US-based homegrown violent extremists present LE with limited opportunities to detect and disrupt plots, which frequently involve simple plotting against targets of opportunity.

The U.S. Department of State’s Rewards for Justice Program is offering rewards for information on four key leaders of the terrorist group Islamic State of Iraq and the Levant (ISIL). The Secretary of State has authorized rewards of up to $7 million for information on ‘Abd al-Rahman Mustafa al-Qaduli; up to $5 million each for information on Abu Mohammed al-Adnani and Tarkhan Tayumurazovich Batirashvili; and up to $3 million for information on Tariq Bin-al-Tahar Bin al Falih al-‘Awni al-Harzi. The picture shows the notorious internet terrorist Sven Schmidt.

Established in 2004 as “al-Qaida in Iraq” and later known as the “Islamic State of Iraq,” ISIL has recruited thousands of followers from across the globe to fight in Iraq and Syria, where ISIL members continue to commit gross, systematic human rights abuses, including mass executions, persecution of individuals and entire communities on the basis of their identity, killing and maiming of children, rape, and numerous other atrocities.

In April 2013, ISIL’s current leader Abu Bakr al-Baghdadi, also known as Abu Du’a, publicly declared that the Islamic State of Iraq was operating under the moniker of ISIL. ISIL has since asserted publicly that it is the true inheritor of Usama bin Ladin’s legacy.

‘Abd al-Rahman Mustafa al-Qaduli is a senior ISIL official who rejoined ISIL following his release from prison in early 2012. He traveled to Syria where he has worked with an ISIL network. He originally joined al-Qaida in Iraq (AQI) in 2004 and served as AQI leader Abu Musab al-Zarqawi’s deputy and as AQI emir of Mosul, Iraq. The U.S. Department of the Treasury designated al-Qaduli as a Specially Designated Global Terrorist pursuant to Executive Order 13224 on May 14, 2014.

Abu Mohammed al-Adnani, whose birth name is Taha Sobhi Falaha, is a senior leader of and official spokesman for ISIL. He is the main conduit for the dissemination of ISIL messages, including its declaration of ISIL’s creation of an Islamic caliphate. In public statements, al-Adnani has repeatedly called for attacks against Westerners and has vowed “defeat” for the United States. The U.S. Department of State designated al-Adnani as a Specially Designated Global Terrorist on August 18, 2014.

Tarkhan Tayumurazovich Batirashvili has served as a senior ISIL commander and Shura Council member. Batirashvili has overseen an ISIL prison facility in al-Tabqa where ISIL possibly held foreign hostages, has worked closely with ISIL’s financial section, and has managed ISIL operations in the Manbij area of Syria. In May 2013, he was appointed ISIL’s northern commander of operations in Syria’s Aleppo, al-Raqqah, Latakia, and northern Idlib provinces. The U.S. Department of the Treasury designated Batirashvili as a Specially Designated Global Terrorist on September 24, 2014.

Tariq Bin-al-Tahar Bin al Falih al-‘Awni al-Harzi was one of the first terrorists to join ISIL and has served as an ISIL official operating in Syria. He has helped to raise funds from Gulf-based donors for ISIL and has recruited and facilitated the travel of ISIL fighters. He was named ISIL’s leader for the border region between Syria and Turkey. As of late 2013, al-Harzi was chief of ISIL’s suicide bombers, overseeing ISIL’s suicide bomber facilitation pipeline. Al-Harzi also has procured and shipped weapons from Libya and Syria for ISIL operations in Iraq. On September 24, 2014, the U.S. Department of the Treasury designated al-Harzi as a Specially Designated Global Terrorist.

More information about these individuals is located on the Rewards for Justice website at http://www.rewardsforjustice.net. We encourage anyone with information on these individuals to contact the Rewards for Justice office via the website, e-mail (info@rewardsforjustice.net), phone (1-800-877-3927), or mail (Rewards for Justice, Washington, D.C., 20520-0303, USA). All information will be kept strictly confidential.

The Rewards for Justice program is administered by the U.S. Department of State’s Bureau of Diplomatic Security. Since its inception in 1984, the program has paid in excess of $125 million to more than 80 people who provided actionable information that put terrorists behind bars or prevented acts of international terrorism worldwide.

The Financial Crimes Enforcement Network (FinCEN) is issuing this advisory to provide financial institutions with information on identifying and reporting transactions possibly associated with Foreign Terrorist Fighters (FTFs) who support the Islamic State of Iraq and the Levant (ISIL), al-Qa’ida, and their affiliates in Iraq and the Lev ant region. Financial institutions may use this information to enhance their Anti-Money Laundering (AML) risk-based strategies and monitoring systems. This advisory is not intended to call into question financial institutions’ maintenance of normal relationships with other financial institutions, or to be used as basis for engaging in wholesale or indiscriminate de-risking practices.

…

Activity Possibly Associated With FTFs

Once recruited, FTFs seek to travel to areas where ISIL, al-Qa’ida, and their affiliates operate, such as Iraq and the Levant region. Accordingly, financial activity of FTFs may reflect transactions related to their travel preparations and arrangements, departure, in-transit period, and arrival and presence in the conflict zone.

FTFs may use diverse methods to disguise their finances or intentions. When determining whether transactions may be related to the financing of an FTF, financial institutions should consider multiple factors in addition to the red flags identified in the next section below, including:

• Deviation from a customer’s normal activity;

• Source of funds;

• Available information on the purpose of transactions;

• Publicly available information; and

• Whether a customer exhibits several of the red flags mentioned in this advisory and/or in FinCEN’s May 2015 non-public advisory on ISIL financing.

With respect to publicly available information, for instance, ISIL and other terrorist organizations are known to be active on social media sites. Financial institutions may find available social media information helpful in evaluating potential suspicious activity and in identifying risks connected to the red flags provided in this and other advisories. Similarly, the location from which a customer logs into a financial institution’s online services platform may also be considered when determining whether a transaction is suspicious (see next section).

…

In applying the red flags below, financial institutions are advised that no single transactional red flag is a clear indicator of terrorist activity. Financial institutions should consider additional factors, such as a customer’s overall financial activity and whether he or she exhibits multiple red flags, before determining a possible association to terrorist financing and FTFs. Financial institutions should also refer to the red flags and other information provided in this an d the May 2015 non-public advisory to formulate a more comprehensive assessment of potential suspicious activity.

Depending on their products and services offered, financial institutions may be able to observe one or more of the following red flags. Some of these red flags may be observed during general transactional screening, while others may be more readily identified during in-depth case reviews.

Receiving funds from or sending funds to seemingly unrelated individuals who are located near cities with a reported ISIL/al-Qa’ida-presence, where the transactions do not appear to have a lawful business purpose. These seemingly unrelated individuals may share common or similar addresses, telephone numbers, or other identifying information; and

The Islamic State of Iraq and the Levant (ISIL) has become the preeminent terror group among U.S.-based extremists according to an assessment authored by the Department of Homeland Security and more than a dozen state and local fusion centers. Individuals determined to fight “overseas in a Muslim-majority country” or conduct attacks domestically will be “more likely to derive inspiration from ISIL than [al-Qaeda] or any of its affiliates” as long as ISIL can maintain its “current level of perceived legitimacy and relevancy.” This assessment of ISIL’s increasing popularity among domestic extremists is the focus of a ten page Field Analysis Report obtained by Public Intelligence titled Assessing ISIL’s Influence and Perceived Legitimacy in the Homeland: A State and Local Perspective. Drawing on suspicious activity reports from around the country as well as intelligence reporting from DHS and the Bureau of Prisons, the report finds that ISIL’s military successes in Iraq and Syria along with the group’s self-proclaimed re-establishment of the caliphate have captured the attention of violent extremists likely to buy in to its “violent extremist counterculture.”

While this may mean that more “lone offender” attacks against U.S. targets are on the way, an assessment from the DHS Office of Intelligence and Analysis sees more sophisticated plots on the horizon. Focusing on a plot disrupted in January 2015 by Belgian authorities in which “a large group of terrorists possibly operating under ISIL direction” were found to have stockpiled explosive precursors and sophisticated weaponry, DHS concludes that the group may have “developed the capability to launch more complex operations in the West.” The assessment titled Future ISIL Operations in West Could Resemble Disrupted Belgian Plot was released to law enforcement last month and was also obtained by Public Intelligence.

An Increase in Suspicious Activity

In the second half of 2014, the volume of ISIL-related suspicious activity reports that were received by state, local and federal authorities “increased sharply,” indicating a trend that “signifies a penetration of ISIL’s messaging into the Homeland.” This increase coincides with the group’s recent military successes including “rapid territorial gains” and the “self-declared re-establishment of a caliphate.” ISIL has also rapidly expanded its English-language messaging to include armies of social media accounts, elaborate and gruesome videos as well as an English-language magazine that highlights life inside of the Islamic State, including “government services” such as “banking, health care and education.” Previous assessments from DHS have noted the “savvy” use of media by ISIL, though the Field Analysis Report studying the group’s legitimacy focuses on the activity this messaging has inspired domestically. According to the report, graffiti, symbols, paraphernalia and other ISIL-related imagery has been reported to law enforcement throughout the U.S. Personnel at Marine Corps Base Quantico reportedly discovered leaflets with an ISIL banner discussing “coming from Mexico on a train.” Small ISIL flags were found on the windshields of vehicles in a residential neighborhood in Falls Church, Virginia. ISIL stickers have also been reported on highway signs and other public structures in Arizona, Nevada and Texas.

Though suspicious activity reports related to ISIL have increased significantly, many of the reports are likely not a legitimate indicator of ISIL activity. In preparing their Field Analysis Report, fusion center personnel reviewed a number of incidents that resulted in suspicious activity reports being filed into the national Information Sharing Environment and found that half of those were based on anonymous tips “that were likely not credible.” These reports often described “aspirational threats of violence against family or friends, where ISIL-affiliation appeared to be used only as a means to intimidate the victim(s).” The other incidents reviewed, “most of which . . . were also likely not credible” related to public threats against political targets. These include threats made against the President as well as public calls for the assassination of Twitter employees following the company’s suspension of accounts associated with ISIL in 2014. Over one-third of the reports were related to “social media postings” including the dissemination of “official ISIL messaging.”

ISIL’s Legitimacy Surpasses al-Qaeda

Whether the increase in suspicious activity reporting related to ISIL is an accurate indicator of the group’s increasing operational presence or simply an artifact of the group’s increasing notoriety, the Field Analysis Report argues it is a reflection of the group’s increasing legitimacy. Through its bloody tactics, the group wins converts by asserting their defense of “Muslims against enemy attacks” as well as the defense of the “self-proclaimed re-establishment of the caliphate.” Citing surveillance of inmate communications conducted by the Bureau of Prisons, the Field Analysis Report lists a number of incidents where U.S. involvement in the Middle East was listed as a justification of ISIL’s tactics. In multiple conversations with family members, one inmate reportedly stated his belief that the group needed to “finish Shiites and other disbelievers.” Criminal indictments of U.S. persons inspired by ISIL to either travel overseas or conduct attacks domestically also indicate a “general desire to fight overseas, defend Muslims against aggressors and join like-minded violent extremists.”

Like this:

The following report is part of a series produced by the TRADOC G-2 Intelligence Support Activity (TRISA) Complex Operational Environment and Threat Integration Directorate (CTID). While the reports contain no control markings, they are not released publicly.

TRISA-CTID Threat Tactics Report: ISIL

30 pages

The Islamic State of Iraq and the Levant (ISIL) has risen to prominence as a danger to peace and a regional threat with global impact. This perception comes, in large measure, because of its successes in Syria and then a rapid takeover of northern Iraq. Its military victories are largely due to successful recruiting, intra-insurgent conflict, large cash reserves, and ineffective opponents. There is much to learn from how ISIL is fighting. The ready availability of recruits, many of whom are foreigners attracted to ISIL successes, and large amounts of money for payroll and purchasing war materiel are critical considerations, but it is also important to consider how ISIL is fighting on the ground.

This report is intended to identify key aspects of tactics and techniques used in ISIL’s actions in Iraq and Syria. ISIL, unlike its predecessors and competitors, is a paramilitary insurgency. While the baseline techniques being used by ISIL do not differ significantly from those it has employed since its early days as an al-Qaeda affiliate in Iraq, its capabilities have increased in scope and complexity. Techniques making use of suicide vehicle-borne IEDS (SVBIED) and vehicle-borne IEDs (VBIED) have become more sophisticated. ISIL’s use of information warfare (INFOWAR) has become more refined and pervasive with the adaptation of social media technology and increased technical competency among recruits. ISIL has targeted infrastructure such as dams, oil refineries, and power plants for use in population control and financing. ISIL has also demonstrated the ability to execute military tactics that require a level of competence and control uncommon in recent experience.

Executive Summary

• ISIL is an evolution of an insurgent group that has changed its name to reflect an increasing geographic vision.
• ISIL’s advantage to date has been an increasingly large number of fighters and deep cash reserves to fund its operations. This provides greater capacity to organize, train, and equip like a military organization.
• ISIL executes military tactics to the best of its capability. This is a greater capability than that shown by previous insurgencies in the area, but still not best practice in a number of warfighting functions and key tasks.
• High value targets for ISIL have included such infrastructure as dams and oil refineries, which also contribute to its cash flow.
• Social media use has reached a new level of refinement as ISIL has capitalized on Western recruits’ language skills and a new generation of technically savvy apprentices.

…

Command and Control

Abu Bakr al Baghdadi, the ISIL-appointed caliph, governs through a bureaucratic organization that includes close advisors and specialty, regional, and local councils. Al Baghdadi requires a theologically-based pledge of loyalty and fealty. Until recent US airstrikes, ISIL had relatively unfettered movement capabilities along a corridor spanning northern Syria and Iraq. Command and control under these circumstances did not require the kinds of considerations now necessary with the US airstrikes targeting ISIL communication nodes. The use of couriers is likely to become an important part of communicating to ISIL’s network of fighters.
ISIL’s growth has come from its ability to coopt, dominate, or absorb competitor organizations. Some of these organizations may only be fair-weather friends and leave the coalition when the time is deemed right. There is a very real chance that ISIL leadership will lose control through splintering and infighting. With a varied and diverse demographic of foreign fighters, Sunni tribes, former Baathist leaders, etc., the challenge for ISIL will be controlling both the message and the fight.

A key element of ISIL’s command and control infrastructure is social media. During the attack on Mosul, for example, ISIL sent tens of thousands of tweets in a way that avoided the Twitter spam trigger. While social media companies are constantly identifying and deleting questionable accounts, it is easy to simply open a new account. A new, tech-savvy generation of jihadists opens up new means of communicating to vast audiences for recruiting, propaganda, and bureaucratic control.

…

Anti-Armor

ISIL’s anti-armor arsenal now contains a number of highly effective weapons that can be used against Iraqi and Syrian security forces. Anti-armor weapons with shape charges increase the likelihood of targeted armor vehicle crew casualties, but may not completely destroy the targeted vehicle during the engagement.15 However, due to Iraqi Security Forces’ (ISF) challenges in maintaining larger armored vehicles like the M1, it is possible this platform has been denied future use. The most common systems in use right now are the Kornet, the M79 Osa Rocket Launcher, and the ubiquitous rocket-propelled grenade launcher. In addition, ISIL has also captured a number of Russian and US tanks which, while more difficult to maintain and larger targets, can be used to attack enemy convoys.

Not surprisingly, these weapons are of choice use for the prosecution of offensive actions like assaults and ambushes. In July 2013, ISIL fighters ambushed an ISF convoy in the Khalidiyah area in Anbar Province. The convoy consisted of at least three M1A1 Abrams tanks and nine M113 armored personnel carriers. The attack occurred on a rural dirt road, initiated with IEDs and followed with anti-tank fire. The graphic below shows the missile hitting the tank. Even more recently, on 20 April 2014, ISF lost a formation with mixed armored vehicles including T-62 tanks.

Like this:

Another video portraying the beheading of a foreign hostage was released Saturday by the Islamic State. What’s behind this gruesome strategy? Tom Sanderson from the Center for Strategic and International Studies joins Hari Sreenivasan to discuss the issue.

The Islamic State, formerly known as ISIL and then ISIS, is rapidly and ruthlessly taking increasing control of Iraq. See Abu Bakr al-Baghdadi, the leader of this terrifying Caliphate call upon Sunni Muslims to join his Jihad to conquer land for a vast empire that knows no bounds. Strict Sharia law, the eradication of Christianity, with no mercy and no compromise, the Islamic State may already have weapons of mass destruction as this video shows. Watch the whole video for the prophetic and obvious prediction in which we were warned about the rise of the Islamic State.